PrivyCycle: The Unfinished Symphony of Health App Privacy on Ethereum

by

Inspiration, they say, strikes like a bolt of lightning, often in the most unexpected places. The birth of PrivyCycle was no exception, not in the sterile hum of laptops at ETHCC’s hackathon, but amidst the vibrant, almost theatrical tension of a Berlin summer stage in June 2025. 🌟

There, under the glaring spotlights of d/acc Berlin, Migle Rakitaite, the visionary behind Wxmen Web3Privacy Now, stood before a crowd of Ethereum’s sharpest minds, face to face with the legendary Vitalik Buterin. The air was electric, charged with the weight of a question that had long been whispered but never dared to be asked: Why had the Ethereum Foundation turned a blind eye to the need for crypto-native solutions to safeguard sensitive health data, especially for period tracking apps on the blockchain? In that moment, as the echoes of privacy and responsibility reverberated through the auditorium, the seeds of PrivyCycle were sown. 🌱

speaking of telegram @dacc_kitchen @VitalikButerin

— Alina Latinina (@alinalatinina) June 11, 2025

This is not just a theoretical issue. In the United States, the criminalization of abortion in several states has turned period-tracking apps into potential legal liabilities. Data from services like Flo and Clue can be, and has been, subpoenaed in court cases. Mainstream apps may promise privacy, but they often monetize user data through opaque adtech and analytics deals. The gap between privacy rhetoric and reality is stark. 🕵️‍♀️

At ETHGlobal CannesCC’s 2025 hackathon, Rakitaite joined forces with developers from TACo.build (f.k.a NuCypher), Vialabs.io, 0g.ai, and Waku/Logos (a team almost entirely composed of men, with the notable exception of Rakitaite) to tackle the privacy issues surrounding existing period tracking apps. The result, PrivyCycle, emerged as one of the top 10 projects out of 334 entries and won three separate sponsor prizes. It’s a proof-of-concept, not a product, but it raises crucial questions about whether Ethereum can truly support privacy-first applications beyond DeFi and token swaps. 🤔

Zero-knowledge cryptography (ZK) has long been touted as the solution. ZK-proofs allow one party to prove possession of certain data without revealing the data itself. In the context of fertility tracking, it means proving to a doctor that one’s cycle has been regular for six months without disclosing the dates or symptoms. In theory, it’s brilliant. 🧠

But in practice, zk tooling on Ethereum is still in its infancy. “DeFi zk” — private swaps, zk-rollups for scaling, or zk-NFT proofs — is far ahead of privacy tooling for irregular, longitudinal, non-fungible datasets like medical records or menstrual logs. zk-SNARK circuits remain costly to deploy, Layer-2 solutions fragment data access, and off-chain storage (like IPFS) introduces its own security assumptions. As of mid-2025, no production-grade, audited, open-source zk protocol exists for health data. 🤷‍♂️

PrivyCycle pieced together existing infrastructure, leveraging tech from the sponsors of ETHGlobal Cannes hackathon: Privy.io for identity abstraction, Zurcuit for ZKs, and 0g.ai for lightweight, AI-powered suggestions. During the demo, Rakitaite explained how the app allows users to log symptoms locally, encrypt data on-device, upload it to IPFS, and selectively share it with partners or physicians using threshold keys. 🗝️

But even these AI features raise privacy concerns. “During this period, maybe stay away — or bring her chocolate and flowers,” Rakitaite joked onstage, explaining how the app’s AI would offer anonymized relationship tips based on aggregated data. Yet any AI system offering personalized recommendations, even ‘anonymized,’ implies some level of inference from user data. Without open-source models, audits, or reproducible training processes, these claims of anonymity remain unverifiable. 🤔

The presentation also included an option to export encrypted PDFs or CSV files for doctors, and a doctor-facing dashboard for interpreting AI-generated health insights. But here too, the infrastructure is hypothetical. Most healthcare providers today can’t decrypt, verify, or store zk-protected medical records. The notion that users can “take their data wherever they want” only works if somewhere is prepared to receive it. 🤷‍♀️

🏆 Best Project on Zircuit: PrivyCycle

An encrypted, AI-powered period tracker focused on privacy and user control. Data is shared securely via IPFS, with Zircuit used to log entries.

— Zircuit (@ZircuitL2) July 7, 2025

The financial pitch was equally shaky. Onstage, Ryan Caruso of Threshold claimed the menstrual tracking app market would hit $10 billion by 2034. But that projection comes from a Market Research Future report which estimates the broader femtech market — encompassing wearables, diagnostics, fertility services, and telehealth platforms — might reach that figure. Actual period-tracking app revenues are unknown. Major players like Flo Health and Clue are privately held and historically opaque about data monetization and financials. 💰

What’s clear is the risk. In 2021, Flo was caught sharing sensitive health data with third parties and settled with the FTC. In the post-Dobbs legal environment, where reproductive health data can be weaponized, this isn’t just a privacy issue — it’s a political one. 🚨

That’s why projects like PrivyCycle matter, even in their imperfections. Not because they deliver finished products, but because they expose what Ethereum still lacks: credible, scalable, decentralized privacy tooling for sensitive, personal information. During the mainstage presentation, it was noted that PrivyCycle’s roadmap includes implementing better tooling for access control and data sharing that’s end-to-end encrypted and “more importantly, end-to-end decentralized” by using TACo (Threshold Access Control). TACo were not a sponsor of the hackathon. 🚀

That line landed differently in Paris than it had a month earlier in Berlin, when Rakitaite called the Foundation out directly. The truth is, the Ethereum ecosystem has deferred privacy tooling for years. While Tornado Cash was sanctioned and zero-knowledge L2s proliferated for DeFi scaling, applications for medical, identity, and social data lagged behind. 🕰️

PrivyCycle is not a finished solution. It’s a provocation. A reminder that if Ethereum is to evolve from a financial settlement layer into a social infrastructure protocol, it needs to take end-to-end encryption tooling and zero-knowledge privacy for non-financial data seriously – not just in hackathon demos, but at the funding and protocol level. 🌐

As Rakitaite told the ETHCC crowd:

“On the first day of my daughter’s period, I want to give this as a gift. So she could calculate her fertility much easier, and much better.” 🌸

Read More

2025-07-16 16:43